"call function "prolog_commands" from the main iptables script part
instead of function "script_body" when prolog should be executed
after iptables reset"
"importing iptables line with module pkttype causes parser
error". We do not have any object with the behavior closely
resembling that of iptables module "pkttype" so the importer
creates CustomService object with the code taken from the original
iptables rule. SF bug 3065435
with module pkttype causes parser error". We do not have any
object with the behavior closely resembling that of iptables
module "pkttype" so rules using this module are marked to let
administrator know that they have not been imported properly.
Parser should not abort import process when it encounters this
module though. SF bug 3065435
"iptables redirecting NAT rules in the OUTPUT chain". NAT rules
should be allowed to translate from CustomService to TCP or UDP
service, provided CustomService object is configured with matching
protocol. See also change in libfwbuilder NATCompiler::classifyNATRule::processNext.
"iptables redirecting NAT rules in the OUTPUT chain". This fix
makes it possible to create iptables NAT rule with target REDIRECT
in the OUTPUT chain. The rule should have firewall object in OSrc
and TDst rule elements.
problem reported in the earlier bug (see #1690).
Function Helper::findInterfaceByNetzone() throws FWException, this
changed in v4.1.0 with a fix for #1653.
fixed#1690 "IOS ACL and Procurve ACL compilers fail because
interfaces are not assumed to have network zone "any" anymore".
Compilers for Cisco IOS ACL and Procurve ACL always assumed all
interfaces have network zone "any". Recent changes made in 4.1.0
changed that and compilers stopped working for some rule configurations.
* (PolicyCompiler_cisco::createACLObject): fixed#1688 "Procurve
ACL remarks should be in quotes if they include space"
fixed#1674 "Crash while using Undo Stack". Operation "Cut" should be
represented by an undo macro object and should appear as one operation
on the undo stack.
cut-and-pasting firewall between libraries". GUI crashed if user
performed the following sequence: cut an object, switch to a
different object library, try to paste using keyboard shortcut
Ctrl-V while library object was selected in the tree.
only firewall resets ipv4 stack" only reset ipv4 iptables when there are some ip4 rules; also added action block to usage string of the generated iptables script
fixed#1626 "convert space and other special characters found in
the run time address table object into underscores". The name of
the run-time Address Table object is used for the name of the
ipset module set. Making sure the name is sanitized of the
chanracters considered "special" by shell before it is used.
of command line utilities generated iptables script can
use. Script will check if the utility is present on the firewall
if user requested use of iptables module "set" for run-time
Address Table objects. Also added an input field for ipset in the
advanced settings host OS dialog for Linux to let the user specify
path to ipset if it is not standard.
"set" used to generate iptables command for rules with run-time
AddressTable objects. This module is only available in iptables
1.4.1.1 and later, however some embedded platforms do not have it
even though they ship later versions ofiptables (e.g. OpenWRT).
Use of this module is controlled by a checkbox in the iptables
"advanced" settings dialog which is off by default. This checkbox
becomes disabled when iptables version is set to < 1.4.1.1.
fixed#1622 "Crash when configuring cluster". The GUI used to crash
if user created a cluster copying rules of one of the cluster members
while that rule set was opened in the rule set view.
project panel". Like #1612, open new data file in a new project
panel if current project panel has no data file associated with it
but has unsaved changes.
new project panel". If user has some unsaved changes in the
default project panel (the one with no associated file) and then
uses File/Open menu to open another data file, the file should
open in a new project panel.
Vadim Kurland